Unauthorized callable execution via global name fallback

Unsafe reflection in PraisonAI before 4.6.37 and praisonaiagents before 1.6.37 allows remote attackers to invoke undeclared callables. ToolExecutionMixin.execute_tool falls back from declared tools and the registry to module globals and main, then directly calls the resolved name while the default permission allowlist is unset. Exploitation requires control of a tool-call name; the resulting callable runs with the application process privileges and can change state, expose data, or execute commands when a suitable helper is loaded.